Analysis

  • max time kernel
    37s
  • max time network
    149s
  • platform
    android_x86
  • resource
    android-x86-arm-20240514-en
  • resource tags

    androidarch:armarch:x86image:android-x86-arm-20240514-enlocale:en-usos:android-9-x86system
  • submitted
    24-05-2024 10:22

General

  • Target

    6e2f768166eadc7c3c59008e4d7d76ac_JaffaCakes118.apk

  • Size

    30.7MB

  • MD5

    6e2f768166eadc7c3c59008e4d7d76ac

  • SHA1

    1f79376ba671cddc9440d3ca6777da9542282d41

  • SHA256

    302418ca0a34fa17356ad212aac99cffefc49e004b63418841b9e57d3e43b12f

  • SHA512

    0fa87c0e435f528b26b01ba3ca2c2f32b63528921de9211a1b36f21efefb40e61a01b11e27d000d7d35dad5ab4238b29d1cd97553a1611f5a20909c8ff78f767

  • SSDEEP

    786432:n5U7jkppa2YGGed8nLFAdOzfySMhgztgXEqKdLgLwPk207:i7KpmDgSAdOzfpMS5CKdgLwPk24

Malware Config

Signatures

  • Checks if the Android device is rooted. 1 TTPs 1 IoCs
  • Requests cell location 2 TTPs 1 IoCs

    Uses Android APIs to to get current cell location.

  • Checks CPU information 2 TTPs 1 IoCs

    Checks CPU information which indicate if the system is an emulator.

  • Loads dropped Dex/Jar 1 TTPs 5 IoCs

    Runs executable file dropped to the device during analysis.

  • Queries information about running processes on the device 1 TTPs 1 IoCs

    Application may abuse the framework's APIs to collect information about running processes on the device.

  • Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs

    Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.

  • Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
  • Checks if the internet connection is available 1 TTPs 1 IoCs
  • Listens for changes in the sensor environment (might be used to detect emulation) 1 TTPs 1 IoCs

Processes

  • com.iyuba.voa
    1⤵
    • Checks if the Android device is rooted.
    • Requests cell location
    • Checks CPU information
    • Loads dropped Dex/Jar
    • Queries information about running processes on the device
    • Queries information about the current Wi-Fi connection
    • Registers a broadcast receiver at runtime (usually for listening for system events)
    • Checks if the internet connection is available
    • Listens for changes in the sensor environment (might be used to detect emulation)
    PID:4267

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/data/com.iyuba.voa/.jiagu/classes.dex
    Filesize

    6.2MB

    MD5

    8e80543d4e63f527196c111dee77679f

    SHA1

    e64a80c75682da2856d3c51ac4453a3276ca9dcc

    SHA256

    9b325ea3a90bb408e35cfc4781fcca218659245cda5554f2d678271e8e6c9c1a

    SHA512

    79288a157cd05e298e34c8a3517c202dcf93063a9590ae7775d15a6648d739134508bec467a2cf2ad1f54f313272f19afcc7f09b234abd016d425f793368fea2

  • /data/data/com.iyuba.voa/.jiagu/classes.dex!classes2.dex
    Filesize

    4.5MB

    MD5

    4fc20f626e00eb5cc785aa132da46d93

    SHA1

    ac01c8dc8170bdc4a80995f8ce86f43953150d61

    SHA256

    f1115ee60f43f511ddcbb9c5f304a43a630b7fd417edae3c01264288643decc0

    SHA512

    7cbeda2a7b4e6df5165257433d2b4365ec0128bafe48076574c32c0dcc52d6477692ee6d2e6c58e60a6ac2bb422c3d1c954dabf0c5724ccc1f2424f5c671797b

  • /data/data/com.iyuba.voa/.jiagu/classes.dex!classes3.dex
    Filesize

    5.8MB

    MD5

    5c2cf5a99290ec47dc50d6386b39ed00

    SHA1

    e457ede5ba81856c7fbc447b530bf5df0adb866e

    SHA256

    ecc781b50db24156d72fc6fbb46bc0d2995e624964cc9de6aaf90a033d1e5326

    SHA512

    f7fee0de004e24a807575d2b4814c3bd46f9f7a7c2ee7c5d0d03c95a5dec7f4adbbc96941038a61520eef76a8952b7f7853d3d480cf6c4843a1c71da29c56050

  • /data/data/com.iyuba.voa/.jiagu/libjiagu.so
    Filesize

    485KB

    MD5

    2c1a490890ff15348d2fc3815b2cfb3d

    SHA1

    922e1e5539c40ad5bed578a9cea9f076df02eaee

    SHA256

    4a272d3707e61d656a95d20b944a402a4ae39b79013e3a47a93c0faa3eefc6da

    SHA512

    3a910269e855c3c9a31e40d2d18d166d3c3dc08bb9b063e363be8e737181389e9cc67be8d9ef8d1a63ca0500d0d028aa2562e6fb979beb1a1cccf0fe4d1d1853

  • /data/data/com.iyuba.voa/.jiagu/tmp.dex
    Filesize

    284B

    MD5

    f1771b68f5f9b168b79ff59ae2daabe4

    SHA1

    0df6a835559f5c99670214a12700e7d8c28e5a42

    SHA256

    9f8898ce35a47aeafced99ea0d17c33e73037bb2307c7688e50819966f4ae939

    SHA512

    dae27d19727b89bec49398503baa6801640540355688dfabbe689c97545295c2c2d9b0f0dcd7cbc4cfbf701d0c0c3289e647a152f49ff242d1ecc741efe4145d

  • /data/data/com.iyuba.voa/databases/basic_hds_dlpart.db-journal
    Filesize

    512B

    MD5

    dbbce9d5c35fa7db7a45d8ceebb4f437

    SHA1

    411b605b08290c5cd57025aef6290a7a83ac82c2

    SHA256

    1e9988c468c6df184f12af2b3958171d85cb7278abe94b8645e1e089bd1557eb

    SHA512

    f6c71c56afa20baa6b8008e85de8a8c728fa599a4927c1c12771f3f09289239dd894db91542e9509beb7710c821dd501016a4452bf5b58eef212d493d4409bc1

  • /data/data/com.iyuba.voa/databases/basic_hds_dlpart.db-wal
    Filesize

    32KB

    MD5

    40e21f0b1b028ba989879ca61aea249e

    SHA1

    7cac162dd32ddddbcf7423d992b0da3d34e357b1

    SHA256

    502449df7bb76604e0f5f1853cd3270e9e9bf9e719a256eec45ac6737fb57481

    SHA512

    f8c5129015328584ef7c730479cbe819f9af892e094757f4049f180be2f9a666a72785d831d2469f8aca4da49ab6625e1d82eabf76d8ad9cb31e9bdf8b4f78cf

  • /data/data/com.iyuba.voa/databases/basic_hds_favorpart.db-journal
    Filesize

    512B

    MD5

    e2be3e24a9058e293ee7f1b40d3d6bfc

    SHA1

    cfd8f6eb5433d752d25ec7dfe63d722e3667f1fa

    SHA256

    67fbdf5da915f04e33c8068e3d718bd7ef7e308db7517c4f6a5db84ae048b4e9

    SHA512

    86440470b2cb5d8f94d18bb4fbc42e025777a2e842ad2784c1173307df21e93b20f2bc28f51d32060fca86d89541a47798c862bd94c3305a39687d4fce21167c

  • /data/data/com.iyuba.voa/databases/basic_hds_favorpart.db-wal
    Filesize

    32KB

    MD5

    d8a0e110bd92480bb0e2c34faff27499

    SHA1

    bcab1b2780a9bf877eb702b6500c7f6839043e12

    SHA256

    6120c094632dc37950da08f2a9a006b650dbbc20b545a49df31438f676c8d24b

    SHA512

    f143d662fa6da39f53b07d4b87f11b338f42485eb25ca626dc2ae22aaf17d7bbc9211f412df81b47a8ee1e2651112614fbe8a350fbb164e61c19f15bab08ef4c

  • /data/data/com.iyuba.voa/databases/dictionary.db
    Filesize

    6.6MB

    MD5

    ca06545f09e9e110617b933d631632ae

    SHA1

    42f6f9e62c21822603f97349533ae6b8cde8783f

    SHA256

    8db6518a0b99953122bce34d544dfe24afac82240175709b15e8483e74fd0195

    SHA512

    3416b79b5f75219777b5d5ce50f94153fa84cdde22ececb7c4371dbac504a8bc54211957f3c5e6092d512b28103652eae559835d6a0f852d6c2a6dfc740982de

  • /data/data/com.iyuba.voa/databases/dictionary.db-journal
    Filesize

    4KB

    MD5

    bb2bbf4fd3d23d7890c8f78ca69f7857

    SHA1

    9caf679d93448e0ada901038179d80d90d8a2e3c

    SHA256

    8ad465f54b9b2c3ce9db35970079589158a1634a2de9418e1047de38f6182c45

    SHA512

    6f00a9c471f30b4d0b7d91ff47bd63abd61d066a2a9e06e98d9fa4fa6b076b0f95e760f0b46ea3a91bcb11dcfd2ec4520b01535b6ab3d3a983673f10e16d0695

  • /data/data/com.iyuba.voa/databases/dictionary.db-wal
    Filesize

    4KB

    MD5

    cc5b9f7325f656da63687ccc48cda736

    SHA1

    931525f41c6e28df483556adedd46c3c99d7e33b

    SHA256

    044207ff85c5816b5d998a88a9978299802af8ab684f6cdb5e28f83eb872505e

    SHA512

    73f6327e9f1144e9395f61d62db551ad9eaa0e63df69e60d327122898b39f0b89b065a46fb6a2fb5e3d049be62ad2ebccaab1d2465e569d3f85149ebefca2370

  • /data/data/com.iyuba.voa/databases/download.db
    Filesize

    4KB

    MD5

    f2b4b0190b9f384ca885f0c8c9b14700

    SHA1

    934ff2646757b5b6e7f20f6a0aa76c7f995d9361

    SHA256

    0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514

    SHA512

    ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1

  • /data/data/com.iyuba.voa/databases/download.db-journal
    Filesize

    512B

    MD5

    6eb65a504f336ea652225c77d4b5c254

    SHA1

    b11f1567ce3e802348d220bdf9b0142a860212a6

    SHA256

    198fd5f863caa0dbf01db59b513bbf4f9d7bade10fb773bbaf9c9008189bc4db

    SHA512

    5c58b83b22e48877c83bb66b56bca1646128c1db898f088b2f516511731e119687ee57cb790ddc2586ec5460e0842df39c867406f2ebce018618598c853f607d

  • /data/data/com.iyuba.voa/databases/download.db-shm
    Filesize

    32KB

    MD5

    bb7df04e1b0a2570657527a7e108ae23

    SHA1

    5188431849b4613152fd7bdba6a3ff0a4fd6424b

    SHA256

    c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479

    SHA512

    768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012

  • /data/data/com.iyuba.voa/databases/download.db-wal
    Filesize

    40KB

    MD5

    721b342002a21dec1fd5f11c4e5878e5

    SHA1

    fda09a3e44fc63d4715645f112a98d010ccd05a0

    SHA256

    ac66b5862fe28a37c5eda6c8b4af6af0c7abadca570b35d0e387ae59601d5f43

    SHA512

    3c1b70e80f0b3be5c843bce2eb3112d17d59499304c8c69ba2ce9c552c5ed604bfd7dc836ec88e2b6cf6670317f7c84ed7f9026a71def1d65414e38029d85f15

  • /data/data/com.iyuba.voa/databases/headlines.db-journal
    Filesize

    512B

    MD5

    06a17a11564c7f8fba577f0b3dca3e7f

    SHA1

    1198cb6648a5c9285899d2722643fa5e9f004cbe

    SHA256

    9c2d60301a1653ca8bd42c8faf9e88b4598db976a85ff66ea2e365094977e243

    SHA512

    dd594021e3256507f1ec9b17b4adff0f0568d1f05a99bd39f8e966be8e30ed708c7109c6808ea4a142753e8af09398df130810a1f9ef4aac8de6afd7db3abd79

  • /data/data/com.iyuba.voa/databases/headlines.db-wal
    Filesize

    44KB

    MD5

    2b9ce9dd4de87f09af0c82167a0f870d

    SHA1

    bcab3dd0b66562073f11b08154f28784029df08b

    SHA256

    e6eaeeafd8087a7d8e22a6398103281811220b7ae8c93d5c465c0b893c6b8d0e

    SHA512

    1a26807ec2a91af6614c8900a615434bf0b8a6244683cc73befbd157f65ca471e73bdc6186d468278fbb704dfaab9722b4a5758e3d5caa1ddcd3a00535d74b77

  • /data/data/com.iyuba.voa/databases/imooc.db-journal
    Filesize

    512B

    MD5

    ca0c3d9192fe5f4cdfb0c0e49f4241b7

    SHA1

    e2b228f845211d656d6f66de4cab23c1c2680615

    SHA256

    baa1eb7f26c99f41733ee44aaeddb376a9ddc389ee5d2ec8726e6c31a668d31b

    SHA512

    6c873b35e153648ad0e0253183520da68e63c897eb86244482979a7e9925d0589879558cf9e9a9f040f57e121844ac3f9088cf3895969d8419ebaca17a37f194

  • /data/data/com.iyuba.voa/databases/imooc.db-wal
    Filesize

    68KB

    MD5

    9671e348909bc99df9d23533d98b4c78

    SHA1

    7e2dafb6e50daa0293b719474e6e00e2de39e52e

    SHA256

    fab54bcf4f0ab24950f415a732c6aed63822d7964ca09f1f54f21d6f61421d6b

    SHA512

    a4250d62902e0fe46a8421ad25786a13f0217b315930c80d3d14fad36f9a429b3512d0bbc268695ff37ce68cf059433f46cfd2a8c4815eb3262dc8fb068a285a

  • /data/data/com.iyuba.voa/databases/imovies_data.db-journal
    Filesize

    512B

    MD5

    eb1d4091ba1846d451769edb65f95d2d

    SHA1

    926700c9f28549c6bf1d12452c96fc2bca5b58f9

    SHA256

    76d34beb2b0e5d2e9ae444594c3424219094a8b512265ca5f879dbea85c89bbd

    SHA512

    4ee162090bae8900a6b331ef6aa7fcfcf16955e7940b573b45bc44ae06d35370604d5a927af8f0573950caa5ff9eeffdf2bd0082cc7f41b7f111864c0fdfe6b4

  • /data/data/com.iyuba.voa/databases/imovies_data.db-wal
    Filesize

    52KB

    MD5

    e48b19033e5e1883fd68be56a597fa90

    SHA1

    13eba9eaf4ebccb301192b338dce7533ddafb6f6

    SHA256

    d6082cab819ac9514f57cabc4edeff4d51fc79469ab8df14ec4df22416e04349

    SHA512

    e16f894ba5c673b4372ee72d747e32ffb173251581603039f59ec87e09fed7dc6715bbd2b86dfbe5d22d03870f07e78d36ff082ecbd5580084e496bdac4e467e

  • /data/data/com.iyuba.voa/databases/sayings.db-journal
    Filesize

    512B

    MD5

    627be17bc39e39477b783ce8b22ea5c6

    SHA1

    268ca2876efce3110cb230c8ad621821ba873686

    SHA256

    1f29bcc0bda8d6d103e8baabc5b13864f7b15cafe99bf1ad7ce7089a0b0d0eb5

    SHA512

    3064cf07efb48fb6fd52e6c95a2c364fc5502ba2b09bbd944724597c16254bb727da4698a8d48e41df00a0dab3b91367fee709ac7808242214b47d68c7a75f3e

  • /data/data/com.iyuba.voa/databases/sayings.db-wal
    Filesize

    52KB

    MD5

    89427a0b5475efc48bf750c42e37ca3e

    SHA1

    97ed2c3e2d97ae07f95a384396992e8729129d19

    SHA256

    367afa21925985aefe6e9a8bab5e50b6f71d8d9d0cedc6dc00d38711976263ed

    SHA512

    1132d0fa689cb764c223744d30280b07421a29331ea809c3e6b4c52268b1fb0ae3b16e2627c110827346b6841fc1d3aad5a3f116b9d4fa63a4b6a21946a93939

  • /data/data/com.iyuba.voa/databases/voa_database.sqlite-journal
    Filesize

    512B

    MD5

    851a1f0130da077fd0aebf4a04797436

    SHA1

    6f9d89ded340addcfbf520bc2f7956fe5f41ebaa

    SHA256

    14dc79207f599fd63b0e860630137d6aaec49caf567f7c62502453961c358849

    SHA512

    f6eef8ba4e2728ec9d3320312806154fbc3b5f892d345acbdee2d65c71f21b50663e2cbc3a6a5de076e0c8e8b4e76b0b7caed00c9e8f0515d551aaa6ffa60129

  • /data/data/com.iyuba.voa/databases/voa_database.sqlite-wal
    Filesize

    193KB

    MD5

    78075366819b1ba8b35fa3937eb272c6

    SHA1

    148e986da4a7ed4ba45a0bc762abd8072ba857d0

    SHA256

    5816349f03a6cce81e9f01d7030e9a1f6977f87e5044ca29ea824fb753f7123d

    SHA512

    561b2736e11587adc2aeb8ec653f6a41e5d093ae6945be4b41b87d6d368f84c19d099525bb4b6e4679e76d9d5e566b84920b4b7c043712c36080eadb1515315b

  • /data/data/com.iyuba.voa/files/.jglogs/.jg.ac
    Filesize

    32B

    MD5

    2e32f023662e2d57fe2603294eb34495

    SHA1

    ad72542e5cbf8884f63ce94495c040655f05d26a

    SHA256

    cc80dc98fbcb4c2866e7c42d1205a5c0b368ff35604ca8c044b4b85bf7a0d178

    SHA512

    92859633977fd0c921ace5c71e4b711bedc018bcf6c2ff6c2ba837c2113156dfcf55cc892c32c7c7bca429198221911165a3fc167069266e203c588a94549b25

  • /data/data/com.iyuba.voa/files/.jglogs/.jg.di
    Filesize

    340B

    MD5

    68ea59e2fe17a59b979e866d20e7ce89

    SHA1

    02127266aa46aa56419371968d12789601979b78

    SHA256

    81a31856d45b2678b379075d2743fd01c80e52834f639f2fd4d9c498a87a65e9

    SHA512

    e84708b170032012dd71500a84692c1f89ae2f85abfc96976a8140e511c6aa5fc106cf00067556c593c4e9f21500a6fa5a34fb643cfb6554a076633aeaa2435d

  • /data/data/com.iyuba.voa/files/.jglogs/.jg.ic
    Filesize

    32B

    MD5

    b1a3f4b4beb6fa03869cd7c01befdc39

    SHA1

    d83a6db8ff610895ca4ea6ee3ee04cd9d8112d6a

    SHA256

    602bc3c6f7f61f123f5e70d3274aaf159c433eb7204e60cf7caf910902867e56

    SHA512

    48c11a7678b58c80aa239cb1ac1bbe4dca487f1aae7a5804da99b7360519e4fc3e3e18760bdc36240e4a2b6c21819796cf01a47f703dfae4abde8a43af5a770a

  • /data/data/com.iyuba.voa/files/.jglogs/.jg.rd
    Filesize

    73B

    MD5

    e2a61876eea737f863510c5c0a6f452f

    SHA1

    654b239bb2b3140c83bef2e2fab4c66425b1fafa

    SHA256

    be794a67770ebf0c1230e48d8d84fb4a1364896e4e7727e05ea984ef642047f3

    SHA512

    1e976b2681b0a9c353473f7f92b7beec058e462c04f9d82b38f9b89dbc8d820303368704aa1e8a807d9c745287c287fc756b42dc97c2bc3367082f2df591e6ab

  • /data/data/com.iyuba.voa/files/.jglogs/.jg.ri
    Filesize

    314B

    MD5

    507786b7a8c766a319ba05d99a44117a

    SHA1

    4f7ea209f236caf12824bbe5ecc1efacfa85f9be

    SHA256

    3e666b95b8a2a319dacf8db1260f8d4b3a0a82658342ae2d3e99966ec9f01704

    SHA512

    9cb1f7f8e0e37a8345f507a52646a645ab281cb36f205d6263ceb3ea7e874eaabd7697dd3a0e08a82630e8fe0d130649547548f8fdea00a742811241741568b3

  • /data/data/com.iyuba.voa/files/.jglogs/.jg.store
    Filesize

    32B

    MD5

    448e391c59eef34ee1defbe4dee4c41f

    SHA1

    df1f890987371d7d8e6963c68b787856e42bc146

    SHA256

    55612e17689f4bb05f27e18b4f6d06ffef92a6a8893a5cfdd3d5b99a6028b549

    SHA512

    ce336ce895ba861dda7da27e8869dea065eb3c3403cac55cdf1935409e5ebc95b495370f87ed7416af20af533b15615472e333ae9f2fd2713040f526835399b7

  • /data/data/com.iyuba.voa/files/.jiagu.lock
    Filesize

    27B

    MD5

    5b97c0028d480b6b201214fc3c8e6a20

    SHA1

    93df41917a76b0419207741fb9e6ea06da14afed

    SHA256

    f871e1ab82e0f6a79fc963c047eedb20e707698da5b775eff5e7ccf469f2cf89

    SHA512

    90c4f0badd82e84f91cec466b97183711e99ee48373d6ce5a31e0e79e0606db736f819cba975c7935ec8f49eb4611611b5fc2617ec4fc69bd46870ee02d9d02c

  • /storage/emulated/0/360/.deviceId
    Filesize

    48B

    MD5

    1d8d16c4e3b19ebf18988530d9b9a757

    SHA1

    bc94c1cce05cd848a53271ecb9c5311e27ffebf5

    SHA256

    abd87140da8de3d0aa39a24a8d52bfe7b2eb28f7a3d505f205471c7e8f4964d7

    SHA512

    4562d1eedbc5c2dd7f25cd1c70343053fd451026403585182b142a64f17016c1bd0bf6ad51667b439b220e425640e55fbbda08517e7106376cdc220a4555da82

  • /storage/emulated/0/360/.iddata
    Filesize

    32B

    MD5

    e69832a12fe55fbb65eafd0222c03f9c

    SHA1

    afafa48aba753ee752f94f4143d38cc302fbb1c9

    SHA256

    b1342c0722f9bef15b11e21059e68ae8e982cd950b3ad5efba854597175d39c8

    SHA512

    34f0d8a0fc3d4e5739fc8dec273009e62fd788b8db2e47f68a3c3464265f1aa0b88a5bb037726a5cbbdd319b6794074e11be8fed712678995217a06b8024e927